- British Midland B737 Flight 92 at Kegworth
- Accident Overview
- Accident Board Findings
- Accident Board Recommendations
- Relevant Regulations
- Prevailing Cultural / Organizational Factors
- Key Safety Issue(s)
- Safety Assumptions
- Resulting Safety Initiatives
- Airworthiness Directives (ADs) Issued
- Common Themes
- Related Accidents / Incidents
- Lessons Learned
- British Midland B737 Flight 92 at Kegworth
Photo of British Midlands Airways Boeing 737-400 G-OBME
Photo copyright Frank C. Duarte Jr. - used with permission
History of Flight
British Midlands Airways (BMA) Ltd Flight 92 departed London Heathrow Airport en route to Belfast International Airport at 1952 hours local time, with eight crew members and 118 passengers. The airplane was a Boeing Model 737 Series 400 (737-400), equipped with two CFM56-3C turbofan engines.
About 13 minutes into the flight, as the aircraft was climbing through 28,300 feet, a fan blade failed in the left engine, resulting in severe vibration and a series of engine stalls and surges. An outer portion of a fan blade had failed and separated, causing severe damage to the entire fan section. The fan blade failure was the result of a blade vibratory instability, referred to as blade flutter, which initiated in the engine fan blade at a specific combination of high thrust and flight conditions.
Diagram of CFM56 Fan Assembly
The aircraft immediately experienced a high level of airframe vibration which was felt in the flight deck by the crew and in the cabin by the flight attendants and passengers. The crew also smelled fire and air conditioning smoke in the flight deck. No visual or aural alerts accompanied the failure.
According to the accident report, the passengers and flight attendants also reported the smell of smoke in the cabin. Some described the smell of burning 'rubber', 'oil', and 'hot metal'. Two flight attendants in the rear cabin reported that they briefly saw light colored smoke. Those two, and another flight attendant, reported seeing evidence of fire from the left engine. Many passengers also saw signs of fire from this engine. They described it as 'fire', 'torching,' or 'sparks'. The flight attendants did not relay information to the flight crew regarding the cabin smoke or vibration until requested by the captain about two minutes after the fan blade failure.
As a result of the fan blade failure, the left engine began operating erratically. The automatic throttle (auto-throttle) system was at this point still engaged and active, commanding the engine to maintain the target thrust that had been set for the climb. The flight data recorder (FDR) indicated fluctuations in the left engine parameters. The FDR also indicated that the right engine continued stable operation. The fan speed (N1) for the left engine fluctuated and indicated a lower value than the right engine. Exhaust gas temperature (EGT) for the left engine was about 100ºC higher than the right engine EGT, with an eventual peak difference of about 125ºC. Fuel flow for the left engine dropped and fluctuated. The airborne vibration monitor (AVM) for the left engine indicated five units, the maximum indication on the gage. While the right engine AVM was less than one unit and stable.
Illustration of Flight 92 Flight Path
About eight seconds after the fan blade failure, the captain took control of the aircraft and disengaged the autopilot. During the investigation he stated that he had looked at the engine displays but did not gain any indication of the source of the problem. Just prior to the captain assuming control of the airplane, the first officer had stated, "We got a fire," though there were no overheat or fire indications or alarms at that time.
The captain later stated that he had relied on his knowledge of the aircraft air conditioning system (ACS) and the first officer's assessment of the engine instruments as means to diagnose the problem. He stated that he thought the smoke and fumes were coming forward from the passenger cabin to the flight deck. He also assumed most of the air in the cabin was supplied by the right engine. Thus, he determined the problem was with the right engine. The accident report stated that this reasoning would have been applicable for other early airplanes he had flown. However, the Boeing 737-400 ACS has a portion of conditioned air for the passenger cabin whose source is the left engine. Further, both on Boeing 737 Series 300 and 400 airplanes, the ACS feeds conditioned air from the left engine directly to the flight deck. The investigation concluded that the most likely reason for the captain's assumption regarding the right engine was the result of the first officer's response to his query about which engine was experiencing a problem. The first officer's reply, "It's the lef...it's the right one," reinforced his original assessment regarding the right engine. Believing the first officer had examined the engine instruments and positively identified the problem engine, the captain provisionally accepted the first officer's assessment. The captain then responded by saying, "Okay, throttle it back." This order was given about 19 seconds after the failure.
Photo of 737 Flight Deck indicating Engine Instruments
The auto-throttle was disengaged in order for the first officer to manually reduce thrust on the right engine. Within two seconds of the thrust reduction on the right engine, the left engine fan speed stabilized at a level 3% below its previous stable value, and the EGT stabilized at about 50ºC above the previous stable value. However, the left engine fuel flow was still behaving erratically and continued to drop. The AVM continued to show a vibration value of five units. It was noted in the accident report that "the captain later stated that the action of closing the right engine throttle reduced the smell and the visual signs of smoke and that he remembered no continuation of the vibration after the right throttle was closed."
The first officer advised London Air Traffic Control (LATC) of their emergency 28 seconds after the failure as the airplane was climbing through approximately 30,000 feet.
According to the accident report, 43 seconds after the fan blade failure, the captain ordered the first officer to, "Shut it down," without specifically identifying which engine, leaving the first officer to decide and choose which engine to shut down. Since the first officer had assumed earlier that the problem was with the right engine, he proceeded to shut it down. However, the execution was delayed when the captain said, "Seems to be running alright now. Let's just see if it comes in." The first officer told the captain that he was about to start the ‘Engine Failure and Shutdown Checklist,' but stated at the same time, "Seems we have stabilized. We've still got the smoke."
There were a number of attempts to complete the checklist, some interrupted by communications with air traffic control and with BMA company radio. However, at two minutes and seven seconds after the failure, the right engine was shut down and the auxiliary power unit (APU) was started. At the time of the right engine shut down, the left engine EGT indicated a gradually decreasing temperature and the rotor speeds and fuel flow had stabilized. The left engine AVM continued to display a level of five units.
According to the investigation, shutting down the right engine convinced the captain that his action had been correct because the smell and smoke in the flight deck cleared immediately. The FDR indicated that an initial thrust reduction on the left engine occurred approximately three minutes and ten seconds after the failure. Power was further reduced about one minute later. The left engine then continued to operate with no adverse indications other than the continuing indicated high levels of vibration and increased fuel flow. The high level of vibration continued for about another three minutes and then gradually decreased to between two and three units on the AVM indicator. The captain later stated that he believed the emergency situation had been successfully concluded and that the left engine was operating normally. His conclusion was based on the apparent stability of the engine indications.
After the right engine was shut down, the captain announced to the passengers that there was trouble with the right engine. He stated that the engine had produced some smoke in the cabin, that the engine had been shut down, and that they could expect to land at East Midlands Airport in about ten minutes. The flight attendants who had seen signs of fire on the left engine later stated that they did not hear the captain's reference to the right engine. However, many passengers who had seen fire from the left engine heard, and were puzzled by, the captain's reference to the right engine. Some passengers were still aware of a continuing vibration. The accident report noted that this discrepancy and continued vibration were not brought to the attention of the crew. However, it was noted that, by the time the captain made the announcement, the smell of smoke in the cabin had dissipated.
Photo of wreckage on embankment
Following the shutdown of the right engine, flight crew workload remained high. The captain did not re-engage the autopilot, and he flew the aircraft manually for the rest of the flight. The first officer engaged in radio communications, obtaining details of weather at East Midlands Airport (EMA) and unsuccessfully attempted to program the flight management system to indicate EMA as the destination airport.
Seven minutes and 23 seconds after the failure, the captain attempted to review the situation. He asked the first officer, "Now what indications did we actually get (it) just rapid vibrations in the airplane, smoke..." The last situation assessment by the crew had been attempted approximately two minutes after the failure, as they began the ‘Engine Failure and Shutdown Checklist.' However, that activity had been suspended and was not reinitiated. The renewed attempt at assessing the situation was interrupted by ATC communications: heading changes, descent clearance, and instruction to change radio frequency to EMA approach control.
Following the radio frequency change, the first officer began the one-engine inoperative descent and approach checklist. This checklist was interrupted with radio calls from the EMA approach controller asking the captain to make a test call to the aerodrome fire service. The captain made the call but received no response. The approach checklist was finally completed as the aircraft was descending through 6,500 feet and 15 nautical miles from EMA.
At 13 nm from touchdown, and descending through 3,000 feet, power was increased on the left engine to level the aircraft. The vibration level increased to the indicator maximum level of five units. At the time, the aircraft was still within the starter assist in-flight restart envelope. The landing gear was lowered when the aircraft was above 2,000 feet and 5.3 nautical miles from touchdown, and at a speed of approximately 175 knots. As the aircraft reached 2.4 nautical miles from touchdown, at an altitude of about 1,000 feet, power from the left engine abruptly decreased. The aircraft had slowed to about 150 knots and flaps were set at 15º.
The captain ordered the first officer to restart the right engine, and he opened the fuel valve in an attempt to obtain a windmill relight. However, the aircraft was now at the low speed boundary of the starter assist in-flight restart envelope, too slow to achieve a successful windmill relight. The crew informed air traffic that they were having difficulties restarting the right engine. During the start attempts, a fire warning occurred on the left engine. The aircraft was drifting below the glide slope, and the captain raised the nose of the aircraft to extend the glide. The ground proximity warning system (GPWS) sounded, followed by a stall warning.
The aircraft crashed with a last known airspeed of 115 knots. It came to rest after breaking into three sections on the western embankment of the M1 motorway, 900 meters (0.56 miles.) from the threshold of EMA runway 27. Seventy-four occupants were seriously injured and five others suffered minor injuries. There were a total of 47 fatalities. An animation of the flight path is available at the following link: (Flight Path Animation)
CFM56-3 Turbofan Engine
Diagram of CFM56-3 Engine
The GE/SNECMA CFM56-3 engine is a high-bypass, dual-rotor, axial-flow turbofan engine, and is rated for a range of 18,500 to 22,000 pounds of thrust, depending on its installation on the Boeing 737-300, -400, or -500 aircraft. The engine rotors are designed with a five-bearing support configuration with a two-sump lubricating system. The engine features a four-stage integrated fan and low pressure compressor driven by a four-stage low pressure turbine as well as a nine-stage high pressure compressor driven by a single-stage high-pressure turbine. The compressor uses a variable bleed valve and variable stator vane system for airflow control. The CFM56-3 uses an annular combustion chamber and a fan mounted accessory drive system.
The fan consists of 38 titanium alloy fan blades. The blades are 14.5 inches long with a dovetail attachment feature and an interlocking mid-span shroud. The shroud provides for added blade assembly stiffness. Each blade is held in place by a blade retainer and spacer.
Fan Blade Failure
Diagram of CFM56-3 Engine Fan Blade
Photo of Failed Section of Fan Blade
Post-accident investigation determined that the fan blade failure was the result of an aero-elastic vibratory instability caused by a coupled torsional-flexural transient non-synchronous oscillation. It was learned that this instability could occur when the airstream over the fan blade reaches a certain critical velocity. In one of the precipitating events in this accident, this instability caused the excitation of a fan blade to increase exponentially, causing high-cycle fatigue failure of the blade in a short period of time. Testing revealed that in order for this mode to occur, the engine needed to be at a full-power setting, in a high angle of attack attitude, and above an altitude of 27,000 feet. At these higher power levels, the fan blades would be susceptible to a transient non-synchronous vibration during the higher altitude portions of climb and during cruise. A nick or dent on the leading edge of the blade would form a "stress riser" and may enhance the possibility of crack initiation, propagation, and blade failure due to high-cycle fatigue. An animation describing this process is available at the following link: (Fan Blade Failure)
737-400 Engine Indicating System (EIS)
Photo of 737-400 cockpit
Photo copyright Zulfachri Harahap - used with permission
The EIS is a solid state modular unit providing displays of both primary and secondary engine parameters. The primary display consists of fan speed (N1), exhaust gas temperature (EGT), core rotor speed (N2), and fuel flow (FF) for both engines. The display consists of both an analog and digital display by using light-emitting diodes, both to provide an indicator "needle," and numerical indications of rotor speeds to mimic the behavior of electromechanical instruments.
The secondary display consists of analog-only displays of engine oil pressure, engine oil temperature, engine vibration, and A and B system hydraulic pressures. The displays use "pointers" similar to the primary displays, but do not include numerical displays and are smaller than the primary instruments.
Both sets of displays contain sensors to vary display brightness depending on flight deck lighting conditions so that displays remain legible in all lighting conditions from bright, direct sunlight, to darkness. For night operations, display brightness can also be controlled by the crew. With the exception of engine vibration, all parameters are derived directly from sensors located on the engines. Engine vibration is provided by sensors located on each engine, and are then processed by the vibration monitoring system before being passed to the EIS.
AVM Indicators on EIS Secondary Displays
Airborne Vibration Monitoring System (AVM)
The AVM system provides continuous vibration monitoring as well as display of the engine vibration levels via the secondary displays on the EIS. Information is also recorded on the flight data recorder. The AVM module only displays values up to five units on the EIS scale. Vibration values above this maximum value are displayed and recorded as five units. There is no additional indication or alert if vibration levels exceed five units.
Two vibration sensors are mounted on each engine: one on the front bearing support and another on the turbine rear frame. The AVM also uses both low- and high-pressure spools to track vibration signals and filter out any vibrations that are not associated with either N1 or N2 speeds. Although vibration signals from both engine sensors are transmitted to the AVM, only those signals from the forward-bearing support are displayed to the crew on the flight-deck indicators. The higher value of low pressure or high pressure shaft vibration will be displayed to the crew.
In-flight Engine Starting
Following an in-flight failure or shutdown of an undamaged engine, any transport airplane is required to have the capability to restart an engine in flight. There are typically two means by which to restart an engine: a windmill restart and a starter-assisted start.
A windmill start uses airflow through the engine, by virtue of sufficient airspeed, to rotate the engine and supply the necessary rotational energy to initiate the start sequence. During a windmill start, following energizing of the electronic ignitors (similar to spark plugs in an automobile engine), the start sequence is initiated by simply turning on the fuel. The ignitors will cause the fuel to ignite and the engine will accelerate toward idle, relying on the rotational energy provided by airflow through the engine to aid in the initial engine acceleration.
Graph of 737-400 In-flight Restart Envelope Showing Restart Attempts
A starter-assist start, relative to the process employed, is similar to starting on the ground when the airplane is parked. The process requires a source of air pressure to rotate the engine. Starter air is provided either by bleed air from another engine or an APU. Once bleed air flow is established, the flight deck start switch is turned on, providing airflow to the engine being started, and thereby beginning engine rotation and acceleration to a speed sufficient to support airflow through the combustion chambers. Once the engine has reached a sufficient rotational speed (indicated by N1 or N2), fuel is turned on, ignition occurs, and the engine accelerates to idle.
During airplane certification testing, the engine relight envelopes are established. Flight tests are conducted to verify the accuracy and reliability of both portions of the restart envelope and to validate the restart procedures for any particular airplane. Start procedures and specifics, such as required rotational speeds prior to initiation of fuel flow, may vary for engines from different manufacturers. Depending on the engine, in-flight starts may take as long as three minutes.
In this accident, the investigators determined that when the first officer was attempting to restart the right engine, which earlier had been shutdown in error, the airplane was at a low airspeed, near the low speed boundary of the starter assist envelope. Though the APU had been started earlier, the first officer was attempting a windmill start, which, due to the low airspeed, would not have been successful. The investigation also determined that due to the time required to restart the engine, and the remaining time before impact, a starter assist start would also have been unsuccessful.
Illustration of impact sequence
An example of a turbofan engine after a fan blade failure
Full Motion Flight Crew Training Simulator
Inappropriate Crew Response to Malfunctions
British Midlands flight 92 experienced a failure condition which should not have resulted in a catastrophic outcome. The fan blade failure, while resulting in substantial engine damage, did not pose a structural or controllability threat to the airplane. However, the inappropriate response by the flight crew, in shutting down the healthy engine, placed the aircraft in a hazardous condition which was not recognized until it was too late to restart the engine. The circumstances of a benign, or low-hazard condition, followed by an inappropriate crew response has led to a number of accidents. Faulty landing gear indicator lights, tire failures during takeoff, misleading avionics indications, sudden in-flight upset encounters, and other singular events have, when accompanied by an inappropriate flight crew response, occasionally resulted in a catastrophic outcome.
Specifically, in the area of inappropriate crew responses to propulsion malfunctions (such as occurred on flight 92) a 1993 Aerospace Industries Association (AIA) report noted that, as of the report date, a “substantial number of incidents and accidents had occurred with similar links in the causal chain.” The report cited that approximately three accidents per year worldwide were a result of inappropriate crew responses to propulsion malfunctions.
In December, 1994, a British Aerospace Jetstream 3100 crashed while on an instrument approach to Raleigh-Durham, North Carolina. The National Transportation Safety Board (NTSB) identified an incorrect crew response to a momentary propulsion malfunction indication as a primary cause of the accident. The captain incorrectly assumed that an engine had failed, and failed to follow approved crew procedures for an engine failure, for a single-engine approach and go-around, and for stall recovery.
As a result of this Jetstream accident, and at the request of the FAA, the AIA and European Association of Aerospace Industries (AECMA) formed a task force to study the related issue, and in 1998, released a report titled "Propulsion System Malfunction Plus Inappropriate Crew Response (PSM+ICR)". The report concluded that the causal factors included misleading simulator programming in representing engine malfunctions, and lack of pilot training in recognition and appropriate response to engine malfunctions. In 2009, The FAA and Airline Transport Association (ATA), in response to the AIA/AECMA report, went on to develop "Turbofan Engine Malfunction Recognition and Response Final Report" to provide pilot training material and simulator upgrade data packages to address this shortfall. The complete 1998 AIA/AECMA study is available at the following link: (AIA/AECMA Study) (Note: This report is included in a digest from the Flight Safety Foundation which includes multiple reports. The subject report concludes on page 193 of the linked document).
The FAA/ATA training material included a 22 minute video titled “Engine Malfunctions – Recognition and Response” which may be viewed at the following link: Turbofan Engine Malfunction Training Video.
Forward fuselage area. Note that the floor has failed. Photo from the accident investigation.
Cabin Interior and Seat Condition
The investigation of British Midlands flight 92 found that the majority of seats in the center and tail sections remained attached to the floor although some had structural failures. The seats in sections just forward and aft of the wing were extensively damaged due to failure of the floor sections. All protection by the seats was lost when the floor collapsed since this resulted in the passengers and crew being unrestrained and subject to injury from secondary impacts.
16g Seat Rule History and British Midlands Flight 92
The seats on the aircraft are known as 9g static load seats certified to 14 CFR 25.561. This was the standard in place at the time the airplane received FAA type certification in 1988. The more stringent 16g dynamic load seat rule (14 CFR 25.562) was put in place in 1986 after the British Midlands Boeing 737 airplane was already in service with the airline. The 16g seat rule did not require existing airplanes, or their derivatives such the British Midlands Boeing 737-400, to be upgraded to meet the new standard.
Left: Example seat from forward cabin. Note the seat legs have failed and are missing. Right: Example seats from cabin center section. Note the seats are still attached but the aft seat has a failed front spar (cross beam). Photos from the accident investigation.
However, the investigation did find that the installed seats were stronger than average 9g seats (they were likely a 16g seat prototype). This likely improved the seat performance vs. standard 9g seats. For example, the fact that seats stayed attached in the center section shows these upgraded seats provided improved protection from injury vs. seats designed to meet the 9g standard alone which would likely have broken loose.
Cabin center section over the wing. Note that most of the seats are still attached though damaged. Photo from the accident investigation.
Cabin tail section. Note the seats are still attached up to where the floor is disrupted. Photo from the accident investigation.
The British Midlands Flight 92 accident in 1989 was not the accident that led directly to the 16g seat rule but it was one of many that demonstrated that 9g seats do not provide adequate protection to passengers or crew in a survivable crash. Evidence of poor seat performance during the Flight 92 crash sequence includes:
- Seat tracks and seat spars fractured allowing seats to collapse or break loose from the airplane floor resulting in severe passenger injuries and fatalities.
- Seat (and seat track) failures led to injuries and impeded the ability of passengers and crew to evacuate the airplane.
- Passengers sustained severe head injuries, lumbar spine, hip and leg fractures while seated in seats still attached to the floor structure.
A great deal of research went into the 16g seat rule. Seat performance such as that seen in Flight 92 was studied in a number of accidents. The new rule was tailored to improve the seat performance seen during the Flight 92 accident.
A few concepts are fundamental to the 16g seat rule:
- Seats should stay attached up to point of fuselage breakup and have equivalent structural strength to the floor to which they are attached even when the floor is deformed during the accident sequence.
- Seats should deform in a controlled manner such they that they absorb impact energy and minimize injuries to passengers. But the seats should not deform so much that they block evacuation paths out of the airplane or prevent a person from exiting their seat.
- Injury criteria should make for seat designs that provide a high level of protection from head, lumbar spine, and femur leg injuries.
- Seat belt (and belt attachments to the seat) strength and deformation standards should be equivalent to the seats designed to the new dynamic standards.
- The seats should protect occupants for two dynamic pulse load cases. One is an all longitudinal 16g crash loading to simulate running off the end of a runway and impacting ground structure or a berm, for example. The other is a 14g crash loading combining forward longitudinal and down loading to simulate a very hard landing.
Here is an example test showing what happens to older 9g static type seats when subjected to the 16g dynamic requirement. This is similar to what happened to some of the seats on Flight 92. Note the seats breaking loose from the floor and the unrestrained occupants.
Here are videos of similar tests with seats designed to meet the new 16g seat requirement. Note the dramatic improvement in seat performance.
See the Avianca Flight 052 accident module in this lessons learned database for much more on the development of the rule and precursor accidents. That module also contains many more photo and video examples to understand why 16g seats were developed and how they provide a higher level of safety. To illustrate success stories, see the related accidents section from that module for examples of similar accidents for airplanes that were certified to the 16g seat standard. The photo below shows one such success story accident explained in the section.
Photo of Aires Flight 8250 wreckage